In case you were wondering about that Oops page …
On May 12 and May 17, Vtdigger.org was attacked by the Ninoplas or Cehcriecom base64 virus. The Web site was in the cyberspace ER for about 16 hours the first time (on the day the Legislature adjourned), and four hours on Monday.
We came out of both full-blown infections with just a case of sniffles, thanks to our crack triage team, Dan Allen and Josh Larkin.
In the wake of two close calls, we’re taking extra precautions – that we can’t disclose for fear of inviting more attacks – to resolve the problem in the next few days. Suffice it to say, after a stint with GoDaddy.com, we’re going local.
For better or worse, we’re not alone. Thousands of sites on the GoDaddy server system have been hit in the last few weeks, according to the official blog of the Sucuri Security Labs, a well-respected trade site for programmers.
The nastygram that attached itself to every line of code on our Web site looked something like this: http://kdjkfjskdfjlskdjf.com/js.php/. Until we were able to put up our Oops page, what readers saw was a warning from their anti-virus software or a redirect to a virus scan page. And what they didn’t see, of course, was the home page for Vtdigger.org.
At this point, no one knows how the hackers are infiltrating the sites, and that makes it very difficult for Web hosting companies to mitigate the attacks. But infiltrate, they do. Just type in base64 virus into the Google search engine, and you’ll get an eyeful: Link after link of bloggers complaining about sustained, persistent attacks. At first, it appeared the hackers limited their assault to DreamHost, but as it turns out, the contamination wasn’t isolated. GoDaddy, Bluehost and Media Temple were also infected, according to LinuxSecurity.com.
GoDaddy, however, has been the headline-grabber. “A lot of people are talking about us because we’re the largest hosting company in the world,” said Nick Fuller, a communications manager for GoDaddy.
Less than one tenth of 1 percent of GoDaddy sites were hit by the hacker, but when you host 4 million sites that total – under 4,000, Fuller says — is appreciable. It just so happens that Vtdigger.org was a statistical anomaly.
And on Monday, it happened again – this time we had a 300 in 4 million chance of a recurrence. Go figure.
Initially, the sites that were most vulnerable used older versions of the no- and low-cost content management system, Wordpress, according to the web host giant. But eventually, they discovered it had “nothing to do with Wordpress,” Fuller said.
Fuller said GoDaddy is “spending tremendous resources” and experts are working around the clock to repair the security breach. When the fix will be found, though, is anyone’s guess. “We’re not releasing any of that, we have some leads we’re working on but we’re not going to get into those details,” Fuller said. “We want to stop it as well. There’s no benefit to us to have this happen to you.”
We appreciate GoDaddy’s efforts, but we need to be able to retire at a reasonable hour without worrying about whether Vtdigger.org needs to be resuscitated at 3 a.m.
So, in the next week, we hope you’ll bear with us as we continue to shore up security on the site and fix some of the glitches that have affected certain aspects of Vtdigger.org’s styling and functionality.
We will restore, for example, a few of Vtdigger.org’s distinctive graphic elements that disappeared during the feverish virus episode.
And for those of you who subscribe to our automatic e-mail service, we apologize for a recent spate of inconsistent alerts. On a few occasions, double e-mails were sent out to readers. We apologize for this annoying inconvenience; please be patient with us as we work out the bugs in our service. Within a few weeks, we hope to have a more user-friendly subscribe function in place.
